Where should SSL certificates be issued in the Cloudflare → Load Balancer → Kubernetes scheme? How would you organize issuance to the origin in AWS?

In the Cloudflare → Load Balancer → Kubernetes setup, SSL certificates are usually issued at the Cloudflare and/or Load Balancer level to ensure TLS encryption between the client and these components.

For a secure connection to the origin (Kubernetes), you can use:

• TLS between Load Balancer and Kubernetes: certificates are issued and managed within the infrastructure (for example, using cert-manager in Kubernetes).
• Cloudflare Origin CA: Cloudflare can issue certificates for the origin that are trusted only by Cloudflare, providing a secure channel.

In AWS, to issue certificates for the origin, you can organize it as follows:

1. Use AWS Certificate Manager (ACM) to issue and manage certificates.
2. Integrate cert-manager into Kubernetes, which automatically requests and renews certificates via ACM or Let's Encrypt.
3. Configure the Load Balancer (e.g., AWS ALB or NLB) to use these certificates and proxy traffic to Kubernetes.

Thus, TLS encryption is provided at all stages, and certificate management is automated and centralized.